A massive $292 million exploit has sent shockwaves through the cryptocurrency industry, exposing weaknesses in DeFi infrastructure and sparking concerns about the potential for a broader market crisis. The attack, which occurred over the weekend, targeted Kelp's rsETH token and the mechanism used to transfer assets between blockchains. The perpetrator manipulated the system to create large amounts of unbacked tokens, which were then used as collateral to borrow and drain real assets from lending markets, primarily from Aave, the largest decentralized crypto lender.
The incident has dealt a significant blow to DeFi, coming just weeks after the $285 million exploit of Solana-based protocol Drift, and has further eroded investor trust in the nearly $90 billion crypto sector. According to Charles Guillemet, CTO of Ledger, the exploit targeted a LayerZero bridge component, which enables assets to be transferred across different blockchains. The system relied on a single-signer setup, allowing one entity to approve transactions, which was compromised by the attacker. The attacker was able to mint large amounts of rsETH tokens without proper backing, which were then deposited into lending protocols, mostly Aave, to borrow real ETH.
This maneuver has left DeFi lending platforms holding questionable collateral and bad debt, with Aave seeing a $6 billion drop in assets and its token plummeting 15% in the past 24 hours. The incident has raised concerns about the potential for a 'bank run' dynamic, as users rush to withdraw funds. Key questions remain about how the validator was compromised, with uncertainty over whether it was hacked, misconfigured, or misled. The attacker's identity is also unknown, although the scale of the attack suggests a sophisticated actor.
The exploit serves as a reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system. The incident has highlighted shortcomings in how new assets are onboarded to lending platforms, with configurations like Kelp's 1-of-1 verifier setup being particularly vulnerable. While the incident has dealt a significant blow to trust in DeFi protocols, some experts believe that the sector will learn from the incident and become stronger as a result.